0x1101 - Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1)
Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2 - Command 0x1101
After a MIFARE Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE tag.
For MIFARE Plus EV1/EV2/SE/X at SL1 (Security Level 1), the tag is discovered as MIFARE Classic, and can use the same functionality as MIFARE Classic 1K/4K commands in Table XX – MIFARE Classic/MINI® Commands. Furthermore, an additional optional AES authentication is available in this level without affecting the MIFARE Classic 1K/4K functionality. The authenticity of the card can be proven using strong cryptographic means with this additional functionality. In addition to the backwards compatibility mode, MIFARE Plus card can be switched to higher security levels. After MIFARE Plus is authenticated with AES Security Level 1 Key, the Device doesn’t auto detect an error from the MIFARE Tag has been removed to end the pass-through session. To end the pass-through session, the Host application can send the last command, the CANCEL command (0xFF), or receive an error response from the MIFARE Tag.
Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1) - Request Data for Command 0x1101
Tag
Len
Value / Description
Typ
Req
Default
Command
Length
Field Value
Command
Length
Field Value
EV1
EV2
SE
X
Tag
Len
Value / Description
Typ
Req
Default
Tag
Len
Value / Description
Typ
Req
Default
Tag
Len
Value / Description
Typ
Req
Default
81
var
Command to Send. See Table XX – MIFARE Classic/MINI® Commands See Table XX – MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands
B
R
82
01
00 – No Encrypt 01 - Encrypt
83
01
00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag, otherwise, device will provide a double beep.
B
R
End of any wrappers, at minimum including Request Message
MIFARE Increment
Byte 0 – 0xC1 – Increment Command
Byte 1 – Source Sector Number
Byte 2 – Source Block Number
Byte 3 – Key Type 0 = A, 1 = B
Byte 4 to 9 = 6 Byte Key
Byte 10 to 13 = 4 Byte Operand
MIFARE Decrement
Byte 0 – 0xC0 – Decrement Command
Byte 1 – Source Sector Number
Byte 2 – Source Block Number
Byte 3 – Key Type 0 = A, 1 = B
Byte 4 to 9 = 6 Byte Key
Byte 10 to 13 = 4 Byte Operand
MIFARE Restore
Byte 0 – 0xC2 – Restore Command
Byte 1 – Source Sector Number
Byte 2 – Source Block Number
Byte 3 – Key Type 0 = A, 1 = B
Byte 4 to 9 = 6 Byte Key
MIFARE Transfer
Byte 0 – 0xB0 – Write the value from the Transfer Buffer into destination block number
Byte 1 – Destination Sector Number
Byte 2 – Destination Block Number
Byte 3 – Key Type 0 = A, 1 = B
Byte 4 to 9 = 6 Byte Key
Y
Y
Y
Following Authenticate (part 1 and part 2)
3
Following Authenticate. Use this command for an option to put the NFC tag in Security Level 1 AES Authenticated before sending MIFARE Classic commands.
Byte 0 = 0x76
Byte 1-2 = Security Level 1 Card Authentication Key. See NXP doc ds206234, table 113.
Byte 3 = MIFARE Plus AES_Key# (same key numbering as First Authenticate)
Y
Y
Y
Y
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature.
Byte 0 = 0x3C
Byte 1 = 0x00, RF
Y
Y
N
N
Personalize UID
2
Set anti-collision, selection and authentication behavior. The execution of this command requires an authentication to MF Classic sector 0 (use MIFARE Read command sector 0 from Table 96 – MIFARE Classic/MINI® Commands).
Once this command has been issued and accepted by the PICC, the configuration is automatically locked. A subsequently issued ‘Personalize UID Usage’ command is not executed and fails.
Byte 0 = 0x40
Byte 1 = Encoded type of UID usage:
- 0x00 = UIDF0 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3
- 0x40 = UIDF1 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3 and optional usage of a selection process shortcut
- 0x20 = UIDF2 = anti-collision and selection with a single size random ID (4-byte) according to ISO/IEC14443-3. After the card is configured with random ID, it won’t be able to perform any MF Classic authentication since MF Classic authentication requires UID.
- 0x60 = UIDF3 = anti-collision and selection with a single size NUID (4-byte) according to ISO/IEC14443-3 where the NUID is calculated out of the 7-byte UID
Y
Y
N
N
CANCEL
1
This command is used to terminate the pass-through command session.
Byte 0 = 0xFF
Y
Y
Y
Y
1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2
Encryption Control. If encrypted, see Table XX - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table XX – Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See Encryption Type for a list of valid values.
B
R
End of any wrappers, at minimum including Response Message
/DF7A
var
NFC/MIFARE Data
B
O
Beginning of any wrappers, at minimum including Request Message
1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2
MIFARE Read
Byte 0 – 0x30 – Read Command
Byte 1 – Sector Number to Read
Byte 2 – Start Block Number
Byte 3 – End Block Number
Byte 4 – Key Type, 0 = A, 1 = B
Byte 5 to 10 = 6 Byte Key
MIFARE Write
Byte 0 – 0xA0 – Write Command
Byte 1 – Sector Number to Write
Byte 2 – Start Block Number
Byte 3 – End Block Number
Byte 4 – Key Type 0 = A, 1 = B
Byte 5 to 10 = 6 Byte Key
Byte 11 to x = Variable length Byte Data (16 bytes per block)
First Authenticate (part1 and part2)
3
First Authenticate. Use this command to switch to higher security levels. This command is behaved as the last command. Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep.
Byte 0 = 0x70
Byte 1-2 = Level 2 Switch Key (MIFARE Plus X only), or Level 3 Switch Key. See NXP doc ds206234, table 113.
Byte 3 = MIFARE Plus AES_Key#
- 0x01 = AES_Key1 = 16 bytes value stored in Property 1.2.1.1.4.5 MIFARE Plus AES_Key1.
- 0x02 = AES_Key2 = 16 bytes value stored in Property 1.2.1.1.4.6 MIFARE Plus AES_Key2.
- 0x03 = AES_Key3 = 16 bytes value stored in Property 1.2.1.1.4.7 MIFARE Plus AES_Key3.
- 0x04 = AES_Key4 = 16 bytes values stored in Property 1.2.1.1.4.8 MIFARE Plus AES_Key4.
- 0x05 = AES_Key5 = 16 bytes values stored in Property 1.2.1.1.4.9 MIFARE Plus AES_Key5.
- 0x06 = AES_Key6 = 16 bytes values stored in Property 1.2.1.1.4.A MIFARE Plus AES_Key6.
Beginning of any wrappers, at minimum including Response Message
/DFDF59
var
Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table XXX.
B
FC
var
NFC/MIFARE Data Container
T
MIFARE Classic/MINI® Commands
MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands
Response Data for Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2
If the request started successfully, the Request Status in the message wrapper is: OK, Started / Running, All good / requested operation was successful.
Request Example (Read Sector 0, Block Number Start 0 - End 0, KeyType A, Key = FFFFFFFFFFFF)
Response Example (Read Sector 0, Block Number Start 0 - End 0, KeyType A, Key = FFFFFFFFFFFF)